2

The 3 options we are considering are listed below. Which one is best or is there a better solution we didn't consider. All servers are linux with nginx. Do you see anything particularly wrong with either of them?

Additional clarification. The nginx php-fpm server will have open ports to sql sever and file shares hence the intermediate fire wall. In addition it may be required to transcode video so the reverse proxy server will load balance instances of the nginx php-fpm server.

1) Internet -> firewall -> nginx reverse proxy in DMZ -> firewall -> nginx php-fpm -> files & sql server

2) Internet -> firewall -> nginx php-fpm in DMZ -> firewall -> files & sql server

3) Internet -> firewall -> nginx reverse proxy in DMZ -> firewall -> nginx php-fpm -> vm firewall -> files & sql server

4) Internet -> firewall -> nginx reverse proxy in dmz -> vm firewall in dmz -> nginx php-fpm in dmz -> corporate fire wall -> files & sql server

  • 1
    What's with all the extra firewalls? – Michael Hampton Mar 16 '15 at 21:23
  • 1st is front facing to internet. 2nd is corporate firewall. Between 1 & 2 is the DMZ. The 3rd... well I don't know but someone floated it. – Jim Mar 16 '15 at 21:39
1

Your DMZ should look like figure 6 from the below link. You should only have one firewall with a DMZ on a separate link/ vlan / and not routable to your internal except my specific IPs

                     DMZ
                      ^
                      |
                      v

INTERNET <------------> FireWall <---------->Internal Network

http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/3-3-1/configuration/example/ZBF_ConfigExample.html

  • That is a great resource, thanks. We wondered about if the server in the DMZ was rooted then passwords to internal network resources could be compromised, and mapped file repositories would be accessible. Do you have any insights on these concerns? – Jim Mar 16 '15 at 22:19
  • That's the idea of a DMZ. It shouldn't have ANY access to your internal network because of these concerns. If you MUST have access to the internal network you want it locked down as much as possible. For example, we have a web server that we have located at a Colo site. We can RDP into it but it has different usernames and passwords than our normal accounts and has no access back into our network. Only a foward facing IIS server and SQL database – Ericrobert Mar 16 '15 at 22:46
  • Where does the web server with access to the database go? In my original post the server labeled "niginx php-fpm" has that access. – Jim Mar 16 '15 at 23:00
  • I was just using my own setup as an example and showing how far removed our DMZ is. In your case you would want the firewall separating the DMZ on another network/subnet and a firewall rule pretty much saying DMZ ---> Internal DENY ALL. What firewall are you using? Some of them have easy DMZ setups now a days. The idea behind a DMZ is that because it is facing the outside world it is much more susceptible to attack. Separating it lowers your chances of them getting to anything important. – Ericrobert Mar 16 '15 at 23:06
  • I am not sure what the physical firewalls are but I am told they are very good. The 3rd firewall in item 3 would be a vm firewall as vmware recommends (if we go that way). The term "sandwiching servers on responsibility" was used when describing item 3. I am not an expert on these topics that is why I came here. Someone claiming to be an expert in our group is proposing item 2 which I have my doubts about. – Jim Mar 16 '15 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.